CVE-2025-65496
📋 TL;DR
A NULL pointer dereference vulnerability in OISM libcoap's DTLS implementation allows remote attackers to crash applications using the library via a specially crafted DTLS handshake. This affects any system running libcoap 4.3.5 with DTLS enabled. The vulnerability causes denial of service but does not allow code execution.
💻 Affected Systems
- OISM libcoap
📦 What is this software?
Libcoap by Libcoap
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service for all users of the affected service, potentially disrupting critical IoT or network communication functions.
Likely Case
Service disruption for applications using libcoap's DTLS functionality, requiring restart of affected processes.
If Mitigated
Minimal impact if DTLS is disabled or if the application has robust crash recovery mechanisms.
🎯 Exploit Status
Exploitation requires sending a crafted DTLS handshake to a vulnerable endpoint. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.6 or later
Vendor Advisory: https://github.com/obgm/libcoap/issues/1745
Restart Required: Yes
Instructions:
1. Update libcoap to version 4.3.6 or later. 2. Recompile any applications using libcoap. 3. Restart affected services.
🔧 Temporary Workarounds
Disable DTLS
allDisable DTLS functionality in libcoap if not required
Recompile libcoap with --disable-dtls configure flag
Modify application configuration to disable DTLS
Network filtering
linuxBlock DTLS handshake packets at network perimeter
iptables -A INPUT -p udp --dport 5684 -j DROP
Configure firewall to block UDP port 5684
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy intrusion prevention systems to detect and block malicious DTLS handshakes
🔍 How to Verify
Check if Vulnerable:
Check libcoap version and DTLS configuration: ldd /path/to/application | grep libcoap and check application configCheck Version:
coap-client --version 2>&1 | grep libcoapVerify Fix Applied:
Verify libcoap version is 4.3.6 or later and test DTLS functionality📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning libcoap
- Segmentation fault errors in system logs
- Unexpected service restarts
Network Indicators:
- Unusual DTLS handshake patterns
- Multiple failed DTLS connections from single source
SIEM Query:
source="*syslog*" AND ("segmentation fault" OR "libcoap" OR "coap")